CVE-2024-47653 Missing Authorization Vulnerability

HighCVSS 7.1 EPSS 0.34%

Published: 2024-10-04 15:15
Updated: 2026-06-17 10:57
Exploit status: No public exploit known

Description

This vulnerability exists in Shilpi Client Dashboard due to lack of authorization for modification and cancellation requests through certain API endpoints. An authenticated remote attacker could exploit this vulnerability by placing or cancelling requests through API request body leading to unauthorized modification of requests belonging to the other users.

Affected products

Product	Affected versions	Fixed in
Shilpi Computers Client Dashboard	= <9.7.0	No fix listed
shilpisoft client dashboard	< 9.7.0	9.7.0

References

www.cert-in.org.in third-party-advisory

CVSS v4.0

7.1 High

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: None
Privileges Required: Low
User Interaction: None
Vulnerable System Confidentiality: None
Vulnerable System Integrity: High
Vulnerable System Availability: None
Subsequent System Confidentiality: None
Subsequent System Integrity: Low
Subsequent System Availability: None

All scores (3)

v4.0 7.1 · cert-in
v4.0 7.1 · vdisclose@cert-in.org.in
v3.1 6.5 · nvd@nist.gov

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.34% (percentile 27.9)
CWE: CWE-266 Incorrect Privilege Assignment

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.